4e5129b0b02835ceb7de51ab572eb89e2c430fa3ff1ab105708f28987d6e99f0

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 17.3MB
Sample260928-e6stqage74
SHA256 4e5129b0b02835ceb7de51ab572eb89e2c430fa3ff1ab105708f28987d6e99f0
MD5 1d36c1cb000388bb2d53fde17f32559b
SHA1 ff0c1305c8768b255bf6ee8176e21eaba0547090
SHA512 510788fb8b15ac9aa91b7742529f326458da1011f1104965cd62ac3d7edd3c73bbbba8db9aa20de27f98d429d6cf4af47b99c18f324177d74be8646da981f7ca
SSDEEP 393216:9nODV4doC/o9epEyHxigqoVZHB4l6ZzGC6lH2lMqlmwjX8Evp:9iV4aC/o0p1Rig3zB4HC6nq4M8a
TLSH
T1C8073342316D6033CCE734BA5F252F7028A0F52AF35CE428EA1CDA79A5274E56E7D2D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  setup.exe
- Size 17.3MB
- SHA256 4e5129b0b02835ceb7de51ab572eb89e2c430fa3ff1ab105708f28987d6e99f0
- MD5 1d36c1cb000388bb2d53fde17f32559b
- SHA1 ff0c1305c8768b255bf6ee8176e21eaba0547090
- SHA512 510788fb8b15ac9aa91b7742529f326458da1011f1104965cd62ac3d7edd3c73bbbba8db9aa20de27f98d429d6cf4af47b99c18f324177d74be8646da981f7ca
- SSDEEP 393216:9nODV4doC/o9epEyHxigqoVZHB4l6ZzGC6lH2lMqlmwjX8Evp:9iV4aC/o0p1Rig3zB4HC6nq4M8a
- TLSH
  T1C8073342316D6033CCE734BA5F252F7028A0F52AF35CE428EA1CDA79A5274E56E7D2D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/runtimes.exe
- Size 12.7MB
- SHA256 aebf032aa3e567c208589867ce7a3f67aacd68a5beab36ff16d8a49339d57f8d
- MD5 b36910049318d32ad743a2b2fd20756c
- SHA1 b17961f97d950b81633c30401f31a4db3ff6f4b3
- SHA512 b62a04a0332a29d5781f23b44ea497456bb39f7da6c0deb7e8e60ec58fdace0e5374b6b09d8003bf05e446b295cac54026472066e47ba8ebf66965ef6a18518f
- SSDEEP 393216:iq+VmyJx6aOkZ9t9gj6Jzm88UTF4Fw8Lcgv90Sz0:iLV3D6ajd9gI8Ul8IA05
- TLSH
  T1D0D6331871AC7232DDF315B8EE3A1B761D61F429E258E02CE51C5F69F1234B06ABD2E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral4
- Target
  $PLUGINSDIR/dxwebsetup.exe
- Size 288KB
- SHA256 2cf71d098c608c56e07f4655855a886c3102553f648df88458df616b26fd612f
- MD5 2cbd6ad183914a0c554f0739069e77d7
- SHA1 7bf35f2afca666078db35ca95130beb2e3782212
- SHA512 ff1af2d2a883865f2412dddcd68006d1907a719fe833319c833f897c93ee750bac494c0991170dc1cf726b3f0406707daa361d06568cd610eeb4ed1d9c0fbb10
- SSDEEP 6144:kWK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQV:VcvgLARDI1KIOzO0
- TLSH
  T19654F15197E4817BE4FA1B311DF2025327797DE86CB9E32E838658881D71780BE35B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral5
- Target
  $PLUGINSDIR/vc14_x86.exe
- Size 6.6MB
- SHA256 f0bab33a302b3cdb2e11113760d016f54fd3d2632c65ba7834fac4f0abd7f1a3
- MD5 8f442d99f1a6bbd563bac8a3cc39953d
- SHA1 4e6b716f6144f56e527771fd518de049afb7fa66
- SHA512 df8e1806e5fb27522e9f985a21ee79c1853bbdaf8a9f3f586e6033ef67f864c578c0673b6eefb86e915e16004a42d262d504d000910d9cfc403f5a7f78fcb575
- SSDEEP 196608:aLZUOEpi9NAIDjaCF7vomfTamgujlukvSJPWd6hzk:OeYQAjaCF7QUgujYfJPWd6hzk
- TLSH
  T10A662332A0A51033EBF111B7A928A5303D7CF3282B15C8ADD3D8AD1D3D658E5A7F7256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral6
- Target
  $PLUGINSDIR/vc2013_x86.exe
- Size 6.2MB
- SHA256 53b605d1100ab0a88b867447bbf9274b5938125024ba01f5105a9e178a3dcdbd
- MD5 38a1b890ce847167d16567cf7b7a5642
- SHA1 0f5d66bcaf120f2d3f340e448a268fe4bbf7709d
- SHA512 907a9aac75f4f241a85ecb94690f74f5818eea0b2241d9ef6d4bf171f17da0f4bc702e2bb90c04f194592fcc61df5c250508d16b886ed837a74b9f45da9627cd
- SSDEEP 196608:hPMlUtWUVbuVAwgg1wGiU6QCs9FbEwEhMJ:oUUUNHg1wGd6QxbEwv
- TLSH
  T195663331E2649033D2F209B2F92497307E7DF2186710C4BAD658AE1D7A694D3A7FB253
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral7
- Target
  HorseLauncher.exe
- Size 1.8MB
- SHA256 93f83d0ead20be789340a3edd26557416c425e09fb2250077293a57ea58c1337
- MD5 26ddb2522973a597ef9e973c027a1484
- SHA1 af0664fd87ffb8a1699103f2f79b76686ca6b6d4
- SHA512 ce9517a736211899ad6f4cbe2d9ca2698a56098a77a4190e172addf18ff6ceb540911b9b757e43fb16eb5f84bbdbb046d008f23fc97ab588e03a704b62feb49b
- SSDEEP 49152:IQsDAOI96Ap5Fjx0o/fbOp8RWqVDIWdO5g7+s0SiIP9z:UAllOp8RWqVDIWdhh
- TLSH
  T192959E2376A801F8E1B7C278C9529A03DBB278551F719ADF07D089AA1F236E15F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  tor.exe
- Size 9.7MB
- SHA256 60c45b01938c799862e511a9a5bab12f959a819c6264a24502edc342165f570c
- MD5 4edd2723154608d3d13f4c93a1c007ef
- SHA1 f064ae020b89e4bf4f0a6e6289d0560f34050ccb
- SHA512 babb21d145a6ffbaebcd18b6c839d684b9c165c00557cf0b397b4d3b0a8401a4171d2774d341eea41158f73e3ab4b99c026737e846b9d41ca6ccd5f1cd99db5b
- SSDEEP 98304:XE7pu2Nw3522D4eSYizAmIJCQKeVuOwPS1A0mYwnQjGTuPjd+u:8pu2G35EQKqwq1A02u
- TLSH
  T114A62947F27710DDC5BAC07892177223F9A13C9C81346B6B599097A62B70B68AF3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral9